Domain-model discovery exposes Secret and SystemLevel attributes to the model

[Flaurite]

Environment

Jmix version: 3.0

Bug Description

The domain-model discovery tools of the AI Tools add-on describe every attribute of an exposed entity, including attributes marked @Secret or @SystemLevel. System-level filtering is applied to entities only, not to their attributes.

In a project created from the standard Jmix template, the User entity has password annotated with @Secret and @SystemLevel. It is returned to the model in the entity summary and in the detailed domain model along with the regular attributes, so the model can select it in a generated query and receive password hashes, subject only to the attribute-level permissions of the current user. An administrator has no such restrictions.

Steps To Reproduce

1. Create a Jmix project from the standard template and add the AI Tools add-on with the data-load tools enabled.
2. In the AI chat, ask "show me the first user" or ask directly for the password field.
3. Inspect the tool response of aitls_getAvailableEntities or aitls_getDomainModelForEntities for User.

Current Behavior

The password attribute is listed among the User properties (propertyNames includes password, propertyLocalizedNames includes Password). The model may include it in the query and show the stored value to the user.

Expected Behavior

• Attributes annotated with @Secret are never exposed to the model and are rejected by JPQL validation if the model references them anyway.
• Attributes annotated with @SystemLevel are hidden by default, consistent with the existing jmix.aitools.dataload.exclude-system-level-entities behavior for entities.
• Hidden attributes are excluded from both the compact entity summary and the detailed domain model, and from the rows returned by query execution.